Critical RCE flaw detected in Cisco’s communication software

Cisco warns that some Unified Communications Manager and Contact Center Solutions products have a critical remote code execution security vulnerability.

Cisco’s Unified Communications and Contact Center Solutions offer voice, video, and messaging services, as well as customer engagement and management.

• Cyber Attack
• Data Breach

India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record

By infosecbulletin / Tuesday , June 23 2026

A cyber attack seems to have affected one of India's top electronics companies. Tata Electronics has said there was a...

Read More

• Hot Topic

Anthropic’s Mythos reportedly broke NSA classified systems in hours

By infosecbulletin / Monday , June 22 2026

The recent finding shows how powerful Mythos is: the AI can access the US government's secret networks in just a...

Read More

• International

OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment

By infosecbulletin / Monday , June 22 2026

Test before going live is important for AI developers. But there's a problem: testing usually uses fake scenarios that often...

Read More

• Cyber Attack

AryStinger botnet infected thousands of D-Link routers globally

By infosecbulletin / Sunday , June 21 2026

AryStinger has taken control of over 4,000 old D-Link routers to use them as proxies for harmful traffic. The team...

Read More

• International

Hacker suspected of sending alerts across Brazil

By infosecbulletin / Sunday , June 21 2026

Brazil's government suspects a hacking attack triggered an unauthorized ‌alert sent to cell phones across parts of the country early...

Read More

• Hot Topic

CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT

By infosecbulletin / Sunday , June 21 2026

A new open-source cybersecurity tool named CyberSentinel AI v3.0 has come out. It is an important step in self-operated security...

Read More

• Event

Barracuda hosts Dhaka roundtable on cyber resilience

By infosecbulletin / Saturday , June 20 2026

Barracuda gathered industry people in Dhaka on 18 June 2026 for a roundtable talk about cyber resilience. The company shared...

Read More

• Alert
• International

CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices

By infosecbulletin / Saturday , June 20 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) asked Fortinet users with FortiGate devices on Thursday to act to protect...

Read More

• Alert

CISA: Splunk flaw under active exploit, patch by Sunday

By infosecbulletin / Saturday , June 20 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has asked federal agencies to protect their systems by Sunday from a...

Read More

• Cyber Attack
• Data Breach

Texas data breach exposes 3 million driver’s licenses

By infosecbulletin / Saturday , June 20 2026

The Texas Parks and Wildlife Department (TPWD) revealed a data leak at its license system provider. This leak exposed private...

Read More

The company issued a security bulletin about a vulnerability (CVE-2024-20253) that could let an unauthorized remote attacker run code on a device.

Researcher Julien Egloff from Synacktiv discovered a vulnerability with a 9.9 base score out of 10. The vulnerability is due to incorrect handling of user-input data stored in memory.

Attackers can exploit this vulnerability by sending a carefully designed message to a specific port. This can allow them to execute any command using the web services user’s privileges and gain root access.

CVE-2024-20253 impacts the following Cisco products in their default configurations:

Packaged Contact Center Enterprise (PCCE) versions 12.0 and earlier, 12.5(1) and 12.5(2)
Unified Communications Manager (Unified CM) versions 11.5, 12.5(1), and 14. (same for Unified CM SME)
Unified Communications Manager IM & Presence Service (Unified CM IM&P) versions 11.5(1), 12.5(1), and 14.
Unified Contact Center Enterprise (UCCE) versions 12.0 and earlier, 12.5(1), and 12.5(2).
Unified Contact Center Express (UCCX) versions 12.0 and earlier and 12.5(1).
Unity Connection versions 11.5(1), 12.5(1), and 14.
Virtualized Voice Browser (VVB) versions 12.0 and earlier, 12.5(1), and 12.5(2).

The vendor says there’s no other solution and advises applying the security updates. The updates fix the critical remote code execution (RCE) flaw.

PCCE: 12.5(1) and 12.5(2) apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn.
Unified CM and Unified CME: 12.5(1)SU8 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512. 14SU3 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512.
Unified CM IM&P: 12.5(1)SU8 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512. 14SU3 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512.
UCCE: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).
UCCX: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1).
VVB: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).

Cisco recommends using access control lists (ACLs) as a mitigation strategy when applying updates is not immediately feasible.